Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Possible Duplicate:
My server's been hacked EMERGENCY

I am seeing strange tcp connection 149.9.1.16:ircd ans it is running perl service and that process is creating huge load on server IPV4 TCP 3u MYIP:58449 -> 149.9.1.16:ircd ESTABLISHED

can i know is this malware or any other service running and eating my server resources My os details are centos5.5

share|improve this question

marked as duplicate by Iain Feb 27 '12 at 8:28

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

2 Answers 2

That's bad - it looks like your server is a part of botnet.

If you don't know where proces runs, check some info about it ('pid' is process id):

ls -l /proc/'pid'/fd
cat /proc/'pid'/cmdline

Find bad script and kill it. I guess, it's located in /tmp, /var/tmp or defined temporary directory for your webserver. It's a good chance, that script was uploaded via bad coded webpages; find it and repair.

share|improve this answer
2  
Realistically, the only repair is a clean install and restore from a clean backup. –  Iain Feb 27 '12 at 8:06
    
Sorry, this is not good advice. Once your system has been rooted, its not yours anymore. In my experience, fiddling around like this is much less cost effective and secure than nuking and starting again. –  RobM Feb 27 '12 at 8:17
    
If there is a hole in your backup, your server still has a problem.. Better is to know where the hole is and repair it. –  stderr Feb 27 '12 at 8:19
1  
You cannot repair it with any confidence - it's not your system any more. If your backups are no good then rebuild from your sources... –  Iain Feb 27 '12 at 8:27
2  
I'd tcpdump it first out of interest. –  Tom O'Connor Feb 27 '12 at 11:07

If this isn't something you are expecting then it is most likely malware. Your only real solution is to shut the system down. Get an image for later analysis. Nuke the system from orbit then restore from a known good backup - it's the only way to be sure.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.